# Openssl

# Checking certificates and keys

**Checking Using OpenSSL**

If you need to check the information within a Certificate, CSR or Private Key, use these commands. You can also check CSRs and check certificates using our online tools.

<dl id="bkmrk-check-a-certificate-"><dd>**Check a Certificate Signing Request (CSR)**</dd><dd>openssl req -text -noout -verify -in CSR.csr  
</dd></dl><dl id="bkmrk-check-a-private-key-"><dd>**Check a private key**  
</dd><dd>openssl rsa -in privateKey.key -check  
</dd></dl><dl id="bkmrk-check-a-certificate--1"><dd>**Check a certificate**  
</dd><dd>openssl x509 -in certificate.crt -text -noout  
</dd></dl><dl id="bkmrk-check-a-pkcs%2312-file"><dd>**Check a PKCS#12 file (.pfx or .p12)**  
</dd><dd>openssl pkcs12 -info -in keyStore.p12</dd></dl><dl id="bkmrk-check-the-fingerprin"><dd>**Check the fingerprint of a certificate.**  
<dl><dd>**Get SHA-1 fingerprint:**  
<dl><dd><dl><dd>openssl x509 -noout -in certificate.pem -fingerprint -sha1  
</dd></dl></dd></dl></dd></dl></dd></dl><dl id="bkmrk-get-sha-256-fingerpr"><dd><dl><dd>**Get SHA-256 fingerprint:**  
<dl><dd><dl><dd>openssl x509 -noout -in certificate.pem -fingerprint -sha256  
</dd></dl></dd></dl></dd></dl></dd></dl>**You can check if an SSL certificate matches a Private Key by using the 2 easy commands below.**

<dl id="bkmrk-for-your-ssl-certifi"><dd><dl><dd><dl><dd><dl><dd>**For your SSL certificate:** openssl x509 -noout -modulus -in &lt;file&gt;.crt | openssl md5  
</dd><dd>**For your RSA private key:** openssl rsa -noout -modulus -in &lt;file&gt;.key | openssl md5</dd></dl></dd></dl></dd></dl></dd></dl>

# Create a .pfx file

**Create a .pfx file from certificate and private key:**

openssl pkcs12 -export -out domain\_name.pfx -inkey privkey.pem-in fullchain.pem

<div class="mw-geshi mw-code mw-content-ltr" dir="ltr" id="bkmrk-"><div class="text source-text">  
</div></div>

# Extract certificates from .pfx file

**The \*.pfx file is in PKCS#12 format and includes both the certificate and the private key.**

  
  **export the private key:**  openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes  
  **export the certificate:**  openssl pkcs12 -in certname.pfx -nokeys -out cert.pem  
 **remove the passphrase from the private key:** openssl rsa -in key.pem -out server.key